Detection At Virustotal.com

I was trying to verify a file at virustotal.com this evening. As soon as I submitted it for analysis, the site got blocked by BD and the alert in the image below showed up. Rather strange, if you ask me, considering what website we're talking about.

What's so dangerous at this site that everyone uses to check files with various antivirus scanning engines that BD decided to block it?

Find more posts tagged with

Comments

csalgau

The problem you mentioned was not immediately reproducible in a few short tests and we do not think it is a general situation.

Was the submitted file detected locally by BitDefender before you tried uploading it?

Could you please provide some results for at least some of the following:

- rescan the file locally and, if applicable, provide the detection name. A copy of the file or a hash on it would also be useful.

- retry this with a different, not detected file

- retry this with a different, detected file

Thank you.

AndreiRC

No, the file was not detected by BD locally. I did a contextual scan on it and it came up negative. I'm not sure exactly what happened there.

I merely wanted to test the file at Virustotal.com because I wanted to know if it's harmful or not. I found it in a folder in ProgramData ... the file is called PostBuild.exe. It's location is this one: C:\ProgramData\Temp\{01FB4998-33C4-4431-85ED-079E3EEFE75D}. I already sent it to DanyDan for analysis. If you want me to send it to you as well in an archive, let me know.

I tried with other clean files and that didn't happen.

csalgau

Given the lack of detection on that file, it would seam that a cumulus of factors specific to your situation triggered the detection.

Please try to:

- upload a different, not detected file

- if possible, upload a different, detected file

- reupload the mentioned file to see if you get the same reaction a second time

- reupload the file trough another browser

- provide us with some details on your browser

Thank you

AndreiRC

I uploaded a different not detected file. There was no reaction from BD.

I uploaded that same file. BD reacted with that same message.

I used another browser to upload it. BD reacted again.

The first browser I used is an up-to-date Firefox 3.6.8. The second is IE 8.

AndreiRC

And sorry to double post, but I had no detected file to upload there.

alexcrist

Hello,

Please send me that file as well. Thank you.

Cris.

AndreiRC

Just sent it to you, Cris.

coolcool1227

Hi Catalin

With reference to below link in which you said "the Gen: in the detection name, is not signature based", how would the the Virus "Gen:Variant.Agent.1" be detected by its behaviour, if it is merely uploaded without running or executing?

http://forum.bitdefender.com/index.php?showtopic=20351

AndreiRC

It's not even detecting the file in question ... it's detecting something the website is doing, I believe.

I did some research and it seems the folder in which the "PostBuild" file is has something to do with webcam software made by Cyberlink. Although, I'm not 100% sure about it. Hope Cris or DanyDan can confirm that.

csalgau

We are trying to isolate the problem and will post back as soon as we have something conclusive. Thank you for the report.

@ONT: Please reread my last post in that topic - I stated that the detection is part of our proactivity work. Executed threats are monitored by Active Virus Control and are not labeled as this one.

AndreiRC

Thank you, Catalin. I'll keep an eye on the thread.

csalgau

A corrected version of the detection has been delivered to users some 12 hours ago.

If possible, please perform an update and retry.

Thank you.

AndreiRC

No more detection when uploading that file at VirusTotal.com.

And VirusTotal says the file is clean, 0/40 detections.

Thanks for the quick fix.